CN100417127C - A User Management Method Based on Dynamic Host Configuration Protocol - Google Patents

Abstract

The invention discloses a user management method based on a dynamic host configuration protocol, which comprises the following steps: ①The client sends out a DHCP request; ②The DHCP server responds to the client request, establishes user control information, and limits the user's access ability; ③Authenticates the user, and Return the authentication result to the DHCP server; ④The DHCP server updates the user control information according to the authentication result, and sends the new network configuration to the client; ⑤The user accesses the Internet normally, and the DHCP server processes other DHCP information of the user. By adopting the method of the invention, the problem of weak user management when the user uses DHCP to access is solved, multiple authentication modes can be selected, the expansion is convenient, and the network maintenance burden is greatly reduced. Moreover, the method of the present invention well integrates the feature of DHCP that is convenient for network configuration, and at the same time satisfies the strict requirements of the access server on user management, making DHCP an operable and convenient broadband access mode.

Description

A User Management Method Based on Dynamic Host Configuration Protocol

technical field

The invention relates to a broadband access network, in particular to a method for an access server to authenticate and manage DHCP (DynamicHost Configuration Protocol) access users.

Background technique

The full name of DHCP is Dynamic Host Configuration Protocol (Dynamic Host Configuration Protocol), designed by IETF (Internet Network Engineer Task Force), and the detailed protocol content is in RFC document rfc2131. DHCP is an extension of BOOTP (Bootstrap Protocol, see RFC951). Based on the C/S (Client/Server client/service) mode, it provides a mechanism for dynamically specifying IP addresses and network configurations. It is mainly used in large-scale network environments and configurations are difficult. The place. The network administrator concentrates the network configuration parameters on the running DHCP server, and the DHCP server automatically specifies IP addresses and routing configurations for the hosts in the network. Some configuration parameters specified by the DHCP server are not related to the IP protocol, but this does not It will not affect the communication between computers, on the contrary, its configuration parameters make the computer communication on the network convenient and easy to realize. And DHCP allows IP addresses to be leased, which is a more prominent function compared to BOOTP, especially for large-scale networks with a large number of computers, such as a campus network in a university, where each computer has a static IP address. Sometimes it may be unnecessary. The DHCP server specifies a lease period for each IP address. The lease period can be 1 minute or indefinitely. The client can also continue to use IP resources by renewing the lease. When the lease expires, the DHCP server can recycle the IP address and distribute it to other machines. This feature also satisfies the requirements of the access server. In addition, DHCP can also satisfy mobile services very well. This is because DHCP provides a reservation mechanism. Although the physical location of the client computer has changed, the basic information of the client computer still exists in the server. Previously used addresses can still be used if the IP address has not been assigned.

DHCP can be well used in the internal LAN of the enterprise, greatly reducing the burden of planning, management and maintenance of the TCP/IP network, and automatically assigning and recycling IP addresses, basically without human intervention. However, this traditional DHCP networking method is only an enterprise-level IP network, which is based on the internal trust of the enterprise and does not operate. From the perspective of the operator, it is a zero-management network, especially the DHCP Server is mainly used For network configuration management, users are managed in a collective manner. Except for IP addresses, multiple users use the same network configuration. A small change will affect the entire network, and it cannot be modified dynamically, requiring manual work by the administrator. Intervention, so it is suitable for use in a relatively stable intranet. However, the access network is required to provide customized services for a single user. The configuration of each user is independent and can be dynamically updated to meet management needs. Therefore, when DHCP is used as a service realization mode of broadband access, the existing technology cannot perform necessary management on users well.

Contents of the invention

The purpose of the present invention is to overcome the shortcoming of the lack of operation and management mechanism for DHCP in the prior art, to propose a method for fully utilizing the characteristics of DHCP to facilitate network management, and to realize effective authentication and management of DHCP access users.

The core idea of the present invention is: by introducing the control information of the user, the management function of the DHCP Server to the user is enhanced, and the control information can affect the negotiation process of the DHCP and the online behavior of the user. The acquisition and change of user control information is closely related to user authentication, thus satisfying the requirements for user authentication and management in the access network.

The technical scheme of the present invention is achieved in this way. A user management method based on Dynamic Host Configuration Protocol, comprising the following steps:

①The client sends a DHCP request;

②The DHCP server responds to the client request, establishes user control information, and restricts user access capabilities;

③ The user performs authentication and returns the authentication result to the DHCP server;

④The DHCP server updates the user control information according to the authentication result, and sends the new network configuration to the client;

⑤The user goes online normally, and the DHCP server processes other DHCP information of the user.

The user control information in the step ② includes but not limited to: MAC address of the client, VLANDID and hardware information of the access terminal.

The DHCP server is built in the access server.

In the step ②, the DHCP server responds to the client request including assigning an IP address and corresponding network configuration to the client from the specified IP address pool. The IP address here may be a private network address.

The authentication in step ③ can be WEB authentication or other authentication, but the authentication method adopted must be able to exchange messages with the DHCP server, so that the DHCP server can obtain the client authentication result.

Updating the user control information in the step ④ refers to changing the user's access ability by changing the user control information under the condition of keeping the user online, and passing the corresponding configuration to the client, or allowing the user to use the original private In this case, the system can provide NAT (Network Address Translation Protocol) translation.

In the step ①, for illegal users who have not passed the authentication and user authentication timeout, the DHCP server will take back the IP address, forcibly disconnect the connection, and generate a record.

The method of the invention solves the problem of weak user management when the user uses DHCP to access, can choose multiple authentication methods, is convenient to expand, and greatly reduces the burden of network maintenance. Moreover, the method of the present invention well integrates the feature of DHCP that is convenient for network configuration, and at the same time satisfies the strict requirements of the access server on user management, making DHCP an operable and convenient broadband access mode.

Description of drawings

Fig. 1 is a flow chart of the user management method based on the dynamic host configuration protocol proposed by the present invention.

Fig. 2 is an implementation principle diagram of DHCP access according to an embodiment of the present invention.

Detailed ways

The present invention will be described in further detail below in conjunction with the accompanying drawings.

Fig. 1 is a flow chart of the user management method based on the dynamic host configuration protocol proposed by the present invention. As shown in Figure 1, a user management method based on the Dynamic Host Configuration Protocol comprises the following steps: 1. the client sends a DHCP request; 2. the DHCP server responds to the client request, establishes user control information, and restricts user access capabilities; 3. authenticates the user , and return the authentication result to the DHCP server; ④The DHCP server updates the user control information according to the authentication result, and sends the new network configuration to the client; ⑤The user accesses the Internet normally, and the DHCP server processes other DHCP information of the user.

Before user authentication, the user host running the DHCP client initiates a DHCP request to the access server, and the DHCP server built in the access server allocates an IP address to the client from a specified IP address pool (in most cases, private network address), assigning addresses is a standard DHCP negotiation process, but in order to achieve manageability, it is necessary to establish user control information on the access server to manage users' online behavior.

When establishing user control information, the DHCP server uses the basic information of the client collected during the DHCP negotiation process, including hardware information such as the client's MAC address, VLAN ID, and access port, as the unique identifier of the user, and is associated with the IP address. Addresses and control information establish a one-to-one correspondence. This unique identifier is not fixed, and its lifetime is a period of time from when the user starts to apply for an IP address, when he goes online to when he goes offline. One of the advantages of this is that if the user changes the network card or changes the access location, the network management does not need to make corresponding changes.

After the user control information is established and before the authentication, the client and the DHCP server will still conduct regular DHCP negotiations (mainly for IP address renewal, see the DHCP protocol for details), the DHCP server will still serve the client, but the user control information will determine the user Whether the specified authentication time is exceeded, and the user will be removed from the line in due course to recover IP resources. The traditional DHCP server only sets a lease period, and if the user does not take the initiative to go offline, the assigned IP address can always be used.

After the user obtains the IP address, he can partially realize the function of surfing the Internet, but under the action of the control information, the Internet access is restricted because the user has not been authenticated at this time. The authentication method is beyond the scope of this article. Here we take WEB authentication as an example to illustrate the process: the user before authentication can only visit the specified website related to authentication, or the access server can direct all the HTTP requests of the user to a certain On the specified WEB server (redirection function is required), what you see on the user host is a login page requesting to enter the user name and password. The WEB server receives the user name and password and sends them to AAA (authentication, accounting and authorization server) The server performs authentication and sends the result to the access server. This is only a possible authentication method. In actual application, other mature solutions can be selected, and this article will not introduce them in detail.

If the user passes the authentication, the access server reconfigures the user's control information according to the authentication result, and implements the user's Internet access function according to the rules established when the user opened an account. And in the DHCP negotiation process immediately after refreshing the user control information, the new network configuration is sent to the client. Currently, there are two commonly used update methods, one is to change a public network address for the user, and the other is to still use the original private network address, but provide NAT (Network Address Translation Protocol) conversion. The traditional DHCP server cannot dynamically update the user's network configuration in this way, requiring the intervention of the administrator. If the authentication fails, the user control information is canceled. Even if the user's IP address is still within the lease period, but there is no corresponding control information on the access server, the user still cannot use the network.

After passing the authentication, the user starts to surf the Internet normally, and the DHCP server only processes the DHCP message, does not interfere with the user's Internet access process, and basically does not occupy the user's bandwidth. At this time, the control information undertakes functions such as flow control, link detection, and billing.

Fig. 2 is an implementation principle diagram of DHCP access according to an embodiment of the present invention. As shown in Figure 2, user A accesses broadband access server C through switch B, and obtains private network IP address, DNS, mask and routing configuration from access server C (DNS address, mask and routing are all It is configured in the database of the DHCP server in advance, and then configured to the client through DHCP negotiation). The access server C enables the user A to only access the broadband access portal D by configuring the control information of the user A. Then user A actively logs in to the broadband access portal D, or the access server C transfers all access requests of user A to the broadband access portal D (redirection function is required). After user A logs in to broadband access portal D, the first page he visits is the identity authentication page, which requires user A to enter a user name and password, and then broadband access portal D sends the information to E for authentication (or passes through the broadband access server C relay), and return the authentication result to the broadband access server C, refresh the corresponding user control information, and notify user A of the authentication result at the same time. For user A who has passed the authentication, the broadband access server C conducts DHCP negotiation with user A according to the user control information after authentication. The result of the negotiation can be that user A continues to use the private network IP or use a new public network IP, depending on the system Depends on the configuration. If a private network is used, the broadband access server C needs to add a NAT function or an external NAT server (not shown in Figure 2) to convert the private network IP of user A into a public network IP, and using the public network IP is relatively simple. After updating the network configuration of the client, under the management of the broadband access server C, user A can realize the function of broadband access and access the Internet through router F.

Claims (8)

1. A user management method based on Dynamic Host Configuration Protocol, characterized in that comprising the following steps: ①The client sends a DHCP request; ②The DHCP server responds to the client request, establishes user control information, and limits user access capabilities; the user control information includes but is not limited to: the MAC address of the client computer, the VLAND ID and the hardware information of the access terminal; ③ The user performs authentication and returns the authentication result to the DHCP server; ④The DHCP server updates the user control information according to the authentication result, and sends the new network configuration to the client; the update of the user control information refers to changing the user's access ability by replacing the user control information under the condition of keeping the user online, and Pass the corresponding configuration to the client; ⑤The user goes online normally, and the DHCP server processes other DHCP information of the user. 2. A kind of user management method based on Dynamic Host Configuration Protocol according to claim 1, is characterized in that described DHCP server is built in the access server. 3. A kind of user management method based on Dynamic Host Configuration Protocol according to claim 1, it is characterized in that described step 2. DHCP server responds to client request and comprises assigning an IP address to client from the specified IP address pool and the corresponding network configuration. 4. A kind of user management method based on Dynamic Host Configuration Protocol according to claim 3, is characterized in that described IP address is a private network address. 5. A kind of user management method based on Dynamic Host Configuration Protocol according to claim 1, is characterized in that the authentication in described step 3. is WEB authentication. 6. A kind of user management method based on Dynamic Host Configuration Protocol according to claim 1, it is characterized in that updating user control information in the described step 4. refers to still allowing the user to use the original private network address, but providing NAT conversion. 7. A kind of user management method based on Dynamic Host Configuration Protocol according to claim 1, it is characterized in that in described step 1. to the illegal user that does not pass authentication, DHCP server will take back IP address, disconnect by force, and generate Record. 8. A kind of user management method based on Dynamic Host Configuration Protocol according to claim 1, it is characterized in that for user authentication overtime, DHCP server will take back IP address, disconnect by force, and generate record.

Images